Executive Summary
In early 2026, multiple security vendors attributed the ClixFlare ClickFix campaign and several malware families (CastleRAT, Tsundere Bot, Stagecomp) to the Iranian MOIS unit MuddyWater (Seedworm). However, subsequent analysis reveals this to be an 'attribution cascade' where vendors incorrectly equated the usage of commodity criminal tools with developer ownership. Technical evidence identifies these tools as part of TAG-150, a Russian-speaking MaaS ecosystem featuring multi-tenant panels, CIS locale exclusions, and Russian developer strings.
The link to MuddyWater was primarily based on shared code-signing certificates (e.g., 'Donald Gay', 'Amy Cherne'), which Microsoft later identified as products sold by the 'Fox Tempest' malware-signing service for $5k-$9k. While MuddyWater is confirmed to be a customer of these commodity services, there is near-zero overlap between these criminal tools and MuddyWater's actual custom espionage framework (KeyC2, PersianC2, CHAR) documented in campaigns like Operation Olalampo. This misattribution risks polluting threat intelligence feeds with commodity indicators labeled as state-sponsored espionage.
Key Details
Threat Name
TAG-150 CastleRAT Campaign
Affects
—
Adversary
MuddyWater Other Adversaries and Aliases: TAG-150; Handala Group; Fox Tempest; LeakNet
MITRE Techniques
Malware/Tools
CastleRAT, Tsundere Bot, Fakeset, Stagecomp, Darkcomp, CHAR, GhostFetch, Rhadamanthys, Chaos ransomware, Amadey